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WHAT IS CLAIMED IS: 

1 y{C A method of collecting network traffic data comprising: 

2 receiving a group of information; 

3 determining whether to process the group of information for network data 

4 collection according to a sample algorithm; 

5 processing the group of information for network data collection if the 

6 determination is to process the group of information; and 

7 forwarding the group of information to a destination. 

1 2. The method of Claim 1 wherein the group of information is an IP 

2 packet. 

1 3. The method of Claim 1 wherein the sample algorithm is selected from 

2 one of linear, exponential, natural log, burst, and traffic attribute. 

1 ^/^ The method of Claim 1 wherein forwarding the group of information 

2 to the destination comprises: 

3 identifying the destination using a forwarding table; 

4 if the destination is in the forwarding table, automatically forwarding the 

5 group of information to the destination; and 

6 otherwise sending the group of information to one or more processing engines 

7 to determine routing to the destination and forwarding the group of 

8 information according to the determined routing. 

1 5. The method of Claim 1 wherein forwarding the group of information 

2 to the destination is performed after processing the group of information. 
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1 6. The method of Claim 1 wherein the processing of the group of 

2 information for network data collection comprises: 

3 determining if the group of information is part of one or more recorded traffic 

4 flows; 

5 creating a new entry in a table if the group of information is not part of the one 

6 or more recorded traffic flows; 

7 incrementing a field in an existing entry in the table if the group of 

8 information is part of the one or more recorded traffic flows; and 

9 time stamping the group of information. 

1 7. The method of Claim 6 wherein the processing of the group of 

2 information for network data collection further comprises: 

3 creating a traffic information packet; and 

4 transmitting the traffic information packet to a network traffic data collection 

5 application. 

1 8. The method of Claim 7 wherein the traffic information packet 

2 comprises a header and one or more flow records. 

1 9. An apparatus for collecting network traffic data comprising: 

2 means for receiving a group of information; 

3 means for determining whether to process the group of information for 

4 network data collection according to a sample algorithm; 

5 means for processing the group of information for network data collection if 

6 the determination is to process the group of information; and 

7 means for forwarding the group of information to a destination. 

1 10. The apparatus of Claim 9 wherein the group of information is an IP 

2 packet. 

1 11. The apparatus of Claim 9 wherein the sample algorithm is selected 

2 from one of linear, exponential, natural log, burst and traffic attribute. 
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1 12. The apparatus of Claim 9 wherein the means for forwarding the group 

2 of information to the destination comprises: 

3 means for identifying the destination using a forwarding table; 

4 means for automatically forwarding the group of information to the destination 

5 if the destination is in the forwarding table; and 

6 means for sending the group of information to one or more processing engines 

7 to determine routing to the destination and then forward the group of 

8 information according to the determined routing otherwise. 

1 13. The apparatus of Claim 9 wherein the means for processing of the 

2 group of information for network data collection comprises: 

3 means for determining if the group of information is part of one or more 

4 recorded traffic flows; 

5 means for creating a new entry in a table if the group of information is not part 

6 of the one or more recorded traffic flows; 

7 means for incrementing a field in an existing entry in the table if the group of 

8 information is part of the one or more recorded traffic flows; and 

9 means for time stamping the group of information. 

1 14. The apparatus of Claim 13 herein the means for processing of the 

2 group of information for network data collection further comprises: 

3 means for creating a traffic information packet; and 

4 means for transmitting the traffic information packet to a network traffic data 

5 collection application. 

1 15. The apparatus of Claim 14wherein the traffic information packet 

2 - comprises a header and one or more flow records. 

1 /HjT A network node for collecting network traffic data having one or more 

2 processing engines and a memory comprising a set of instructions to: 

3 receive a group of information; 
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4 determine whether to process the group of information for network data 

5 collection according to a sample algorithm; 

6 process the group of information for network data collection if the 

7 determination is to process the group of information; and 

8 forward the group of information to the destination. 

1 17. The network node of Claim 1 6 wherein the group of information is an 

2 IP packet. 

1 18. The network node of Claim 16 wherein the sample algorithm is 

2 selected from one of linear, exponential, natural log, burst and traffic attribute. 

1 19. The network node of Claim 1 6 wherein the set of instructions to 

2 forward the group of information to the destination comprises a set of instructions to: 

3 identify the destination using a forwarding table; 

4 if the destination is in the forwarding table, automatically forward the group of 

5 information to the destination; and 

6 otherwise send the group of information to one or more processing engines to 

7 determine routing to the destination and forward the group of 

8 information according to the determined routing. 

1 20. The network node of Claim 16 wherein the set of instructions to 

2 process the group of information for network data collection comprises a set of 

3 instructions to: 

4 determine if the group of information is part of one or more recorded traffic 

5 flows; 

6 create a new entry in a table if the group of information is not part of the one 

7 or more recorded traffic flows; 

8 increment a field in an existing entry in the table if the group of information is 

9 part of the one or more recorded traffic flows; and 
10 time stamp the group of information. 
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1 21. The network node of Claim 20 wherein the set of instructions to 

2 process the group of information for network data collection further comprises a set of 

3 instructions to: 

4 create a traffic information packet; and 

5 transmit the traffic information packet to a network traffic data collection 

6 application. 

1 22. The network node of Claim 21 wherein the traffic information packet 

2 comprises a header and one or more flow records. 

1 An apparatus for collecting network traffic data comprising: 

2 one or more route processors; 

3 one or more switch fabrics coupled to the one or more route processors; 

4 one or more destination line cards coupled to the one or more switch fabrics; 

5 a source line card coupled to the one or more switch fabrics, wherein the 

6 source line card 

7 receives a group of information; 

8 determines whether to process the group of information for network 

9 data collection according to a sample algorithm; 

1 0 processes the group of information for network data collection if the 

1 1 determination is to process the group of information; and 

12 forwards the group of information to one of the one or more 

13 destination line cards. 

1 24. The apparatus of Claim 23 wherein the group of information is an IP 

2 packet. 

1 25. The apparatus of Claim 23 wherein the sample algorithm is selected 

2 from one of linear, exponential, natural log, burst and traffic attribute. 
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1 26. The apparatus of Claim 23 wherein to forward the group of 

2 information to one of the one or more destination line cards, the source line card: 

3 identifies the one of the one or more destination line cards using a forwarding 

4 table; 

5 if the one of the one or more destination line cards is in the forwarding table, 

6 automatically forwards the group of information to the one of the one 

7 or more destination line cards; and 

8 otherwise sends the group of information to one or more processing engines to 

9 determine routing to one of the one or more destination line cards and 

1 0 then forwards the group of information according to the determined 

1 1 routing. 

1 27. The apparatus of Claim 26 wherein the one or more processing engines 

2 is located on the source line card. 

1 28. The apparatus of Claim 23 wherein to process the group of information 

2 for network data collection, the source line card: 

3 determines if the group of information is part of one or more recorded traffic 

4 flows; 

5 creates a new entry in a table if the group of information is not part of the one 

6 or more recorded traffic flows; 

7 increments a field in an existing entry in the table if the group of information 

8 is part of the one or more recorded traffic flows; and 

9 time stamps the group of information. 

1 29. The apparatus of Claim 28 wherein to process the group of information 

2 for network data collection, the source line card further: 

3 creates a traffic information packet; and 

4 transmits the traffic information packet to a network traffic data collection 

5 application. 
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1 30. The apparatus of Claim 29 wherein the traffic information packet 

2 comprises a header and one or more flow records. 
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